Fix: Media Adapters Path Traversal Vulnerability S3/Azure/Cloudinary Unrestricted mediaRoot Range

Vulnerability Overview This vulnerability involves media adapters (such as S3, DOS, Azure, and Cloudinary) failing to properly check whether object keys fall within the range during upload and delete operations. As a result, even without a configuration, any authenticated editor can access the entire bucket via IAM credentials, rather than being restricted to the portion specified by . Scope of Impact S3 / DOS: Object keys in upload and delete operations are not correctly restricted to the range. S3 - express: By default, is clamped to 3600 seconds, but this PR does not address this limitation. Azure / Cloudinary: Upload and delete operations may access the entire bucket in the absence of a configuration. Remediation Plan 1. Introduce function: Parse object keys within (or ) to ensure they are consistently normalized and confined within the range. 2. Update media adapters: Apply the function in all upload and delete operations across all media adapters. 3. Test coverage: Add 110 test cases covering various edge cases and anti-patterns to ensure the effectiveness of the fix. Proof of Concept (POC) Code Behavior and Testing S3 with mediaRoot set: Upload and delete operations are now performed strictly within the range (this also fixes previous mismatches between upload and list operations). Client/API configuration changes: Upon deployment, if is not configured, the system will reject traversal, absolute, or empty keys. An empty parameter remains valid. Test coverage: — 110 test cases (adversarial vectors + anti-patterns, covering all four implementations), passing on Node 22. Handler-level scan scopes are validated separately. Additional Notes SEC-1: Enforce constraints on for uploads (stored XSS via uploaded HTML/SVG remains a risk on S3, but payloads are now confined to ). SEC-2: Enforce boundaries for Azure/Cloudinary (new configuration: Cloudinary switch requires real environment validation). SEC-4: README — Expand IAM policy scope to (defense in depth). SEC-5: Cloudinary interpolation of directory into search expression DSL (separate injection issue). Conclusion This PR resolves a potential security vulnerability by introducing the function and updating upload and delete operations across all media adapters. This ensures that object keys are consistently normalized and restricted to the range.

Goal Reached Thanks to every supporter — we hit 100%!

Fix: Media Adapters Path Traversal Vulnerability S3/Azure/Cloudinary Unrestricted mediaRoot Range

More from this source